Cross-Site Request Forgery (CSRF)

moodle/moodle is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to information leakage through URLs due to confidential CSRF protection data being exposed on edit and delete pages within the moddata module, allows an attacker to potentially perform Cross-Site Request...

VulnCheck KEV: CVE-2024-38475

Apache HTTP Server contains an improper escaping of output vulnerability in modrewrite that allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code...

mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

A flaw was found in modauthopenidc, an OpenID Connect authentication module for Apache HTTP Server. This vulnerability allows unauthenticated users to access protected content via crafted HTTP POST requests to protected resources when no application-level gateway is present...

CVE-2024-10306

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

CVE-2024-10306

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

Moodle 安全漏洞

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from the edit and delete pages of the moddata module...

Debian: Security Advisory (DSA-5904-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4129-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 5904-1] libapache2-mod-auth-openidc security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5904-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff April 17, 2025 https://www.debian.org/security/faq -...

[SECURITY] [DLA 4129-1] libapache2-mod-auth-openidc security update

Debian LTS Advisory DLA-4129-1 [email protected] https://www.debian.org/lts/security/ Moritz Schlarb April 17, 2025 https://wiki.debian.org/LTS Package : libapache2-mod-auth-openidc Version : 2.4.9.4-0+deb11u5 CVE ID : CVE-2025-31492 Debian Bug : 1102413 A vulnerability has been fixed i...

SUSE SLES15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2025:1324-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1324-1 advisory. - CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. bsc1240893 Tenable has extracted the...

Debian dsa-5904 : libapache2-mod-auth-openidc - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dsa-5904 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5904-1 [email protected] https://www.debian.org/security/ Moritz...

Debian dla-4129 : libapache2-mod-auth-openidc - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4129 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4129-1 [email protected] https://www.debian.org/lts/security/...

DSA-5904-1 libapache2-mod-auth-openidc - security update

Bulletin has no description...

SUSE-SU-2025:1324-1 Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issues: - CVE-2025-31492: Fixed a bug where OIDCProviderAuthRequestMethod POSTs can leak protected data. bsc1240893...

apache2-mod_auth_openidc-2.4.16.11-1.1 on GA media (moderate)

apache2-modauthopenidc-2.4.16.11-1.1 on GA media Announcement ID: openSUSE-SU-2025:14972-1 Rating: moderate Cross-References: CVE-2025-31492 CVSS scores: CVE-2025-31492 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2025-31492 SUSE : 8.2...

USN-6885-4 apache2 regression

USN-6885-1 fixed a vulnerability in Apache. The patch for CVE-2024-38474 was incomplete and caused regressions. This update provides the fix for that issue. Original advisory details: Orange Tsai discovered that the Apache HTTP Server modrewrite module incorrectly handled certain substitutions. A...

CVE-2025-31492

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a modauthopenidc results in disclosure of protected content to unauthenticated users. The...

PT-2025-15122

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.16.11 Description A bug in mod auth openidc results in disclosure of protected content to unauthenticated users. The conditions for disclosure include an OIDCProviderAuthRequestMethod POST, a valid accoun...

CVE-2025-2952: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in Bluestar Micro Mall 1.0. Affected by this vulnerability is an unknown functionality of the file /api/api.php?mod=upload&type=1. The manipulation of the argument File leads to unrestricted upload. The attack can be launched remotely. The exploit...